Privacy Policy

Last updated: June 11, 2026 · Applies to the FirstFound mobile app and firstfound.app

The short version

FirstFound is a camera game: you photograph real-world things and compete to find them first. To make that work we store your email, your photos, and your game activity. We don't sell your data, we don't run ads, and photos are only made public after they're accepted into the game catalog. AI services analyze your photos to identify what's in them.

What we collect

• Account: your email address (for sign-in codes) and the display name you choose.
• Photos: the pictures you submit as discoveries or scavenger-list proofs, plus derived data (an AI description, a visual fingerprint used to detect duplicates, and an optional coarse location area if you grant location access — never your exact GPS position).
• Game activity: your finds, points, badges, lists you create or join, and reports you file.
• Diagnostics: basic crash and error information so we can fix bugs.

How photos are processed

• Photos are stored with Supabase (cloud infrastructure in the United States).
• Each photo is analyzed by an AI vision service (currently Google's Gemini API) to identify the subject and screen for safety problems. Google may process and retain these images per its API terms; do not photograph anything you wouldn't share.
• A separate service computes a numeric "visual fingerprint" used only to detect duplicate submissions.
• Photos you submit stay private to you and our moderators unless your find is accepted — accepted discovery photos become visible to other players in the global catalog. Scavenger-list proof photos are visible to that list's organizer.

Moderation and safety

Submissions can be reviewed by human moderators. Players can report content for safety, privacy, or accuracy problems, and we may remove content or accounts that violate our Terms. Don't photograph people (especially children), license plates, documents, or private property interiors — our systems flag these and moderators reject them.

Who we share with

Only service providers that make the app run: Supabase (database, storage, sign-in), Google Gemini API (photo analysis), Resend (sign-in code emails), and our hosting providers. We never sell personal data and we don't share it with advertisers.

Age

FirstFound is not directed at children under 13, and you must be at least 13 to create an account. If we learn an account belongs to a child under 13, we will delete it.

Your choices

• Camera and photo permissions are optional, but the app is a camera game — without them you can only browse.
• You can request a copy or deletion of your account and data anytime: email hello@firstfound.app from your account email. We delete within 30 days, except records we must keep for safety or legal reasons.

Changes

If this policy changes materially, we'll note it in the app and update the date above. Questions: hello@firstfound.app.